SQL and Proxy acct in a virtual server
Hi all, I'm using Freeradius 1.x for a few years now and I'd like to switch to Freeradius 2.1.10. I have 11 realms: - 7 are managed by this server, using an SQL database - 4 are proxied to different partners, but accountings are saved in the SQL database. Virtual servers seems to be great for this purpose, but I have a few issues with the configuration. I defined realms, home server pools and home server. For locally managed realms, I defined a virtual server for each realm (in sites-available/) and the home server refers to that virtual server. Here is an example for the realm "@foo": ### server vs_foo { authorize { [...] sql_foo [...] } [...] }home_server hs_vs_foo { virtual_server = vs_foo } home_server_pool hsp_vs_foo { home_server = hs_vs_foo } realm foo { pool = hsp_vs_foo } ### It's working like I want to for the locally managed realms, but how could I define different virtual servers for the proxied realms ? I could just define the server to proxy the request to in proxy.conf and do accounting in the default virtual server, just like I was doing with Freeradius 1, but I'd like to define virtual servers in order to separate each realms in virtual servers. If I define home servers and a virtual server in a home server pool, the virtual server is only used for pre/post proxy. "accounting {}" is used from sites-enabled/default. How could I define a specific accounting for a given realm ? Here is what I'm doing for proxied realms: ### server vs_bar { accounting { sql_bar } } home_server hs_bar { type = auth+acct ipaddr = [...] [...] } home_server_pool hsp_bar { type = fail-over home_server = hs_bar virtual_server = vs_bar } realm bar { pool = hsp_bar nostrip } ### The request is proxied but the accounting section is taken from default and not from vs_bar. What am I doing wrong? Thank you, Frank.
Frank Bollet wrote:
If I define home servers and a virtual server in a home server pool, the virtual server is only used for pre/post proxy. "accounting {}" is used from sites-enabled/default.
Yes. That's the way it works.
How could I define a specific accounting for a given realm ?
You don't. I'm not sure what you're trying to do. The virtual servers are there to separate logically independent configurations. Since you're doing *local* accounting for multiple realms, that accounting is done with *one* virtual server. Setting up virtual servers for each *local* realm is not useful. Alan DeKok.
Alan DeKok wrote:
Frank Bollet wrote: How could I define a specific accounting for a given realm ?
You don't.
So, the best practice here is to put specific accounting in sites-available/default ? For example: ### File: sites-available/default [...] accounting { if (Realm == "foo") { sql_foo } elsif (Realm == "bar") { sql_bar } } ###
Setting up virtual servers for each *local* realm is not useful.
I obviously misunderstood the virtual server purpose. I'm basically just trying to separate each realm (actually *partners*, who can have multiple realms but one set of RADIUS proxys) in the configuration. I thought I could use the virtual server functionality to separate each partner. So I would end up with only one file for partner A, that could be very easily [de]activated (with *-available and *-enabled) and easily cloned. Even if virtual servers are not designed for that use, that works for locally managed (ie non proxied) realms, but not for proxied realms because virtual servers only execute pre and post proxy sections in that case. Is there a way to separate the configuration for each partner, or should I just put everything in sites-available/default because it's how it's supposed to work? Thank you, Frank
On Wed, Oct 27, 2010 at 10:06:30AM +0100, Frank Bollet wrote:
Is there a way to separate the configuration for each partner, or should I just put everything in sites-available/default because it's how it's supposed to work?
Hmm, isn't it possible to use $INCLUDE in there, too, so the disabling is done by commenting out a single line...? -- 2. That which causes joy or happiness.
Frank Bollet wrote:
So, the best practice here is to put specific accounting in sites-available/default ?
Isn't that what I already said?
I obviously misunderstood the virtual server purpose. I'm basically just trying to separate each realm (actually *partners*, who can have multiple realms but one set of RADIUS proxys) in the configuration. I thought I could use the virtual server functionality to separate each partner.
Yes, you can. But you then need to proxy (i.e. route) the packets to the correct destination virtual server. You weren't doing that.
Is there a way to separate the configuration for each partner, or should I just put everything in sites-available/default because it's how it's supposed to work?
You can separate the configuration. But you need to configure that. Alan DeKok.
Frank Bollet wrote:
Alan DeKok wrote:
Yes, you can. But you then need to proxy (i.e. route) the packets to the correct destination virtual server. You weren't doing that.
And how could I do that ?
It's just proxying. The difficulty you had earlier was that you were expecting to treat realms differently, but having them all use the same virtual server. Alan DeKok.
participants (3)
-
Alan DeKok -
Frank Bollet -
Josip Rodin